Carionex® — Care Simplified

Trust Centre

Security you can verify, evidence you can request

Carionex helps care and dental agencies run on a platform built with security, privacy and resilience in mind. This page shows what is certified, what is self-assessed, what is tested internally and what is still planned, so your due diligence starts from facts.

Request Security InformationBrowse documents

Evidence status checked 15 November 2026. Items without approved evidence are shown as not yet published.

Assurance

What is certified, self-assessed, tested internally and planned

We separate independent certification from self-assessment and internal testing, so you can weigh each for what it is.

Certifications and registrations

Held by TradeAlgoSuite Technologies Ltd, trading as Carionex.

Published self-assessments

Assessments we complete and publish ourselves against a recognised framework.

  • NHS Data Security and Protection Toolkit 2025–26

    Standards Met

    Published – Standards Met, published 7 August 2026 (Version 8). Organisation code W3K3K. The DSPT is a self-assessment and is not an independent audit.

    Verify on NHS Website (opens in a new tab)

Internal security assessments

Completed internal technical reviews and risk assessments that support our security assurance programme. They are evidence of diligence and are not independent certification.

  • Cross-tenant isolation verification

    Verified Internally

    Tested that one agency cannot read or change another agency's records.

  • Backup and recovery test

    Verified Internally

    Restored files and a database backup into isolated environments and verified them.

  • Encryption at rest verification

    Verified Internally

    Verification records for database, backup, file store and export encryption.

  • Secrets and environment hardening review

    Verified Internally

    Reviewed how credentials and configuration are held outside source code.

  • Known vulnerabilities in direct dependencies

    Verified Internally

    Reviewed direct software dependencies for known vulnerabilities.

  • Data Protection Impact Assessment

    Assessment Completed

    Assessed data protection risks of the platform.

Security Assurance Roadmap

Our planned and ongoing assurance activities. None of the items below is held today, and nothing here should be read as a current certification.

  • Cyber Essentials Plus

    In Progress

    We are currently completing Cyber Essentials Plus, which adds independent hands-on technical verification of our security controls.

  • Independent penetration test

    Not Yet Undertaken

    Not yet undertaken. Independent penetration testing is a future assurance consideration to provide additional validation of application and infrastructure security.

  • ISO 27001

    Future Consideration

    Carionex is not ISO 27001 certified. We continue to strengthen our security governance, policies, evidence and review processes, which supports alignment with recognised standards over time.

  • Recovery time and recovery point objectives

    In Progress

    Being finalised. Not published as commitments until reviewed.

  • Sub-processor location and safeguard verification

    In Progress

    The primary database location is confirmed. Verification of location and transfer safeguards for other providers is being completed.

Security architecture

The controls that protect customer data

Open each control to see what it covers and the evidence behind it. We describe controls, not confidential configuration.

  • Encryption & secure connectionsData is encrypted at rest in the production database and in private file storage, and travels over encrypted connections.
    • The production database and its backups are encrypted at rest by the hosting provider.
    • Uploaded documents and photos are held in a private file store that is encrypted at rest and is not reachable by public URL.
    • Customer data export packages are encrypted before they are made available for download.
    • Connections to the platform use HTTPS/TLS, and database access is restricted to encrypted connections.

    Evidence: Backed by approved encryption verification records. Encryption at rest is supplier-attested rather than independently audited by Carionex.

  • Multi-factor authenticationAuthenticator-app multi-factor authentication protects administrator access to the platform.
    • Time-based one-time password (TOTP) authenticator apps are supported.
    • Multi-factor verification is applied to administrator areas, including Carionex central administration and agency administration.
    • Passwords are stored as salted hashes by the authentication provider and are never visible to Carionex staff.
    • Account sign-in forms are protected against automated abuse.

    Evidence: Applied through the authentication layer of the platform. Availability for individual user types depends on how an agency has configured access.

  • Role-based access controlPeople only see the agency data their role allows, and every agency is isolated from every other.
    • Staff, administrators, practice portal users and Carionex personnel have separate roles and permissions.
    • Row-level security in the database enforces agency separation, so one agency cannot read another agency's records.
    • A cross-tenant isolation test was run against the live configuration and the report has been approved.
    • Privileged changes, such as changing a role, are restricted to authorised administrators.

    Evidence: Backed by the approved Cross-Tenant Isolation Verification Report (10 November 2026).

  • Security audit logsSensitive actions are recorded in an audit log that supports investigation and accountability.
    • Sign-ins, permission changes, exports, approvals and other sensitive actions are logged with the actor and time.
    • Security events can be reviewed, filtered and linked to investigations by Carionex administrators.
    • Detection rules flag unusual activity so that it can be reviewed.
    • Audit records are protected from edits by ordinary users.

    Evidence: Implemented control reviewed in the Carionex Security Centre.

  • Cloud infrastructure protectionPrimary customer data is hosted in the United Kingdom with established cloud infrastructure providers.
    • Hosting arrangements incorporate encryption, access controls, monitoring, backup and recovery measures.
    • Certain supporting services may involve international data processing, subject to appropriate contractual, organisational and data protection safeguards.
    • Detailed hosting, data residency and sub-processor information is available to authorised customers upon request.
    • Secrets and service credentials are kept out of source code and were reviewed in an environment hardening report.

    Evidence: Backed by the Sub-processor Register and the approved Environment Variables and Secrets Hardening Report. Provider location and safeguard checks for some sub-processors are still being completed.

  • Vulnerability & patch managementDependencies are checked for known vulnerabilities and fixes are applied through a controlled release process.
    • Direct software dependencies are reviewed for known vulnerabilities and the result is recorded as evidence.
    • Fixes and updates are released through a controlled deployment process.
    • Security findings from internal assessments are tracked to resolution.
    • No independent penetration test has been completed, and none is claimed on this page.

    Evidence: Backed by the approved Known Vulnerabilities in Direct Dependencies evidence (12 November 2026).

Business continuity

Planning for disruption, and proof that recovery works

Care and dental services cannot stop. This is how we plan to keep running, and what we have actually tested.

  • Business Continuity Plan

    A written plan, approved by the Director, setting out how Carionex keeps its service running during disruption.

  • Disaster Recovery Procedures

    Documented steps for recovering the platform, data and supporting services after a serious incident.

  • Backup and Recovery Arrangements

    Database backups and a separate backup of uploaded files, with recovery tested against an isolated environment.

  • Incident Escalation

    Defined routes for raising, triaging and escalating security and service incidents to the compliance team.

  • Operational Recovery Responsibilities

    Named responsibility for recovery decisions and for restoring each part of the service.

  • Customer Communications

    Customers are told about incidents that affect them, with the information needed to protect their own service users.

  • Service Restoration

    Restoration is verified before service is declared recovered, including access controls and data integrity.

  • Periodic Review and Testing

    Arrangements are reviewed on a schedule and tested, and the results are recorded as evidence.

Continuity contact

compliance@carionex.co.uk

TradeAlgoSuite Technologies Ltd has approved governance arrangements for continuity and recovery decisions.

Request Business Continuity Summary

Demonstrated recovery

Recovery Verified

Tested 11 November 2026. What the Backup and Recovery Test Report actually verified, as an internal test.

  • Uploaded files were backed up and restored into an isolated store, and every test object was checked for content integrity.
  • A database backup was restored into a separate isolated environment and compared with production.
  • Schema, access policies, authentication records and agency isolation were verified on the restored copy.
  • Differences between the restored copy and production were investigated and explained in the report.

Not published as commitments

Under Review
  • Recovery time and recovery point objectives are being finalised and are not published here as commitments.
  • Measured restore timings are recorded in the test report and are shared on request, not quoted as guarantees.
  • Backup schedules are not published on this page.

Data protection and governance

The policies and agreements behind the controls

Each item shows its current status, version and how it can be obtained. Where a document is still under review we say so rather than imply it is in place.

  • Information Security Policy

    Established & Maintained

    Defines Carionex's information security governance, responsibilities and controls for protecting the confidentiality, integrity and availability of information assets.

    Version 3.0 | Last reviewed: 14 November 2026

    Controlled document. Available to authorised customers upon request.

  • Data Protection Policy

    Established & Maintained

    Establishes Carionex's approach to protecting personal information and meeting applicable UK data protection requirements.

    Version 3.0 | Last reviewed: 14 November 2026

    Controlled document. Available to authorised customers upon request.

  • Access Control Policy

    Established & Maintained

    Defines the principles governing authentication, user permissions, privileged access and periodic access reviews.

    Version 3.0 | Last reviewed: 14 November 2026

    Controlled document. Available to authorised customers upon request.

  • Data Retention and Deletion

    Established & Maintained

    Outlines the principles and procedures governing information retention, secure deletion and customer data lifecycle management.

    Version 3.0 | Last reviewed: 14 November 2026

    Controlled document. Available to authorised customers upon request.

  • Incident Response

    Established & Maintained

    Establishes procedures for identifying, assessing, containing, managing and reporting information security incidents.

    Version 3.0 | Last reviewed: 14 November 2026

    Controlled document. Available to authorised customers upon request.

  • Data Processing Agreement

    Published & Current

    Defines the contractual responsibilities, obligations and safeguards governing the processing of customer personal data.

    Version 1.1 | Last updated: 7 November 2026

    Current version publicly available.

    View

  • Sub-processor Management

    Register Maintained

    The register of providers that process customer data, and the process for notifying customers of changes.

    Register version 1.3 | Last updated: 12 November 2026

    Controlled document. Available to authorised customers upon request.

  • Customer Data Ownership

    Contractually Defined

    Customers remain in control of their data. Carionex acts as processor on their instructions.

    Defined in the Data Processing Agreement and Terms of Service

    Current versions publicly available.

    View

  • Secure Data Handling

    Controls Implemented

    Encryption, access separation and audit logging applied when customer data is stored, used and exported.

    Delivered through the encryption, access control and audit controls above

    Supporting evidence available to authorised customers upon request.

    View

Customer data portability

Your data stays yours, and you can take it with you

Agency administrators can export their data from the platform today. A guided self-service migration portal is planned and is not yet available.

Export formats

  • CSVExport Available

    One spreadsheet-ready file per dataset that opens in Excel or any database.

  • JSONExport Available

    Complete records including nested fields, one file per dataset.

  • ZIPSecure Export Available

    Exports are delivered as an encrypted ZIP package with integrity checksums, including original documents.

  • PDFPlanned Enhancement

    Printable report-style exports are planned for the self-service migration portal.

Data categories covered

Which categories apply depends on the modules an agency uses.

  • Care records
  • Client profiles
  • Medication records
  • Staff records
  • Compliance documents
  • Rotas and timesheets
  • Payroll reports
  • Financial records
  • Supporting documents

How to export today

  1. An agency administrator signs in to the platform.
  2. Open Settings, then Business Continuity, then the data portability tab.
  3. Choose the datasets and formats, and create the export.
  4. Download the encrypted ZIP package and verify it using the included checksums.
Sign in to export

Self-service migration portal

Planned Enhancement

A guided portal for planning and receiving a full migration is on our roadmap. Until it is deployed and verified, ask us for help with a migration or exit plan.

Ask about migration support

Document library

Documents for your supplier assessment

Public documents open directly. Restricted documents are released after a short review of who is asking and why, and may be shared under confidentiality terms.

Frequently asked questions

Answers for procurement and due diligence

Every answer is limited to documented policies and implemented controls.

Need something that is not listed here?

Tell us what your procurement, regulator or insurer needs. We will confirm what exists, share what we can, and say plainly what we do not have.

Or email compliance@carionex.co.uk.

Request Security InformationBook a demo
CallBook Demo